Hello,
> create a file named foobar.html
> create a folder named foobar_files
> copy a bunch of files (of any type) inside foobar_files
instead "copy" create for "foobar_files" junction (hard link) to
"c:\windows\system32" (for example)
> delete foobar.html
If user who want delete "foobar.html" have admin rights...
Simple bomb :))
> Even if there's no vuln as such, it's something to be aware of.
don't use Explorer to delete files, restrict policy to use another file
manager to delete files (for example, Far) :)))
--
Best regards,
Albert N. Umerov
Received on Feb 07 2005